Good to know: SecurynAI's free tier is a fully deterministic security plugin on its own — firewall, scanning, and hardening all work with no setup. Plain-English AI explanations require your own OpenAI or Anthropic API key (typically ~$0.10–$0.30/month); without one, you still get clear fallback explanations, just not full AI narratives.

What triggers this alert

SecurynAI flags any administrator account that hasn't had a successful login in 90 days or more (this window is configurable, so your setup may use a different number). This isn't about deleting or disabling anything automatically — it's purely a "this exists and deserves a look" flag.

Why an inactive account is still a risk

The instinct is to think "it's not being used, so it's not a problem." That's backwards for a few reasons:

  • It's still a fully valid administrator account. Full access, sitting there, whether or not anyone's actively using it.
  • Nobody's watching it. An active account owner would probably notice unusual activity on their own login. A dormant one has no one paying attention.
  • It's usually old, and old credentials are weaker credentials. Accounts that haven't been touched in months were often set up under older security practices — a weaker password, no two-factor authentication, or a password that's since appeared in a data breach and been reused elsewhere.
  • These accounts are frequently leftovers. A departed employee, a freelancer or agency whose project ended months ago, a developer given access for a single task and never removed.

Every one of those is a plausible way a dormant account becomes the way someone gets into your site, without anyone noticing until much later.

What to do about it

  1. Identify who the account actually belongs to. If you can't confidently say whose account this is and why they needed admin access, that's already a strong signal it should go.
  2. If the person still needs access, but not admin-level, reduce the role.
  3. If the person no longer needs access at all, remove the account. Don't just leave it "just in case."
  4. If you're keeping it, secure it properly. Enforce two-factor authentication and a strong, unique password.

Why this is worth doing regularly, not just once

New dormant accounts accumulate naturally over time — every contractor engagement that ends, every team member who changes roles, every one-off access grant that outlives its purpose adds one more. Treating this as a periodic cleanup task, not a one-time fix, is what actually keeps the number of unmonitored full-access accounts on your site at zero.

Get every admin account reviewed automatically, not just the ones you remember to check.

Install free →